Stephane Chazelas dixit: >4$ ./mksh -c 'cat <<< "$( : > )aa"' >$( : )aa
>See 4 above where $(...) has not been expanded. Turns out you found another bug, completely unrelated to anything buffer overflow related (in fact, this bug happened because the input was longer than a certain buffer; luckily, the here string case did not actually *need* to write to that buffer, so I used a dummy value in its stead). Thanks! This bugfix took way longer than I thought, and is dedicated to Ypnose. Cheers, //mirabilos -- Gast: „Ein Bier, bitte!“ Wirt: „Geht auch alkoholfrei?“ Gast: „Geht auch Spielgeld?“
